Approved For Rejease 2005/12/01 : CIA-RDP94B01041RQ80300110012-2 
26 October 1981 


_ MEMORANDUM FOR: Deputy Director of Security (PTAS) 


STAT FROM: 5 are 
hnief of Operations (PTAS) 


SUBJECT: - Comments - Unannounced Security Audit Policy 


piisencst Bap) we : aot. - 


Pe cies Ge 


ryt see 


eter ys _ heretics 


ts 


Se re ee fe ot Lag ut Zones ae eae 
“" As Tremembér the historical facts, the then DC@i--after 
Boyce-Lee--felt that the industrial contractors involved with 
national programs were at best very cavalicr in their "put into 
effect acceptance" of Agency contract security standards. I 
believe he felt that the Boyce-Lee exposure at TRW, especially 
after the first Security team's audit report, proved the fact 

and was reason enough to exact some type of punitive measures. 

At any rate, it was at his direction that the unannounced policy 
was put into effect and, as I remember, we tricd to adhere to 

it religiously, even to the point of receiving some really merited 
criticism from industrial leaders. 


2. After the initial flurry subsided, what appeared to be 
a contradictory situation arose. On the one hand, efforts were 
made to repair the CIA-contractor relationship, a part of which 
was to bring the two security interests closer together. Eventually 
this went as far as--during the APEX era--to make corporate security 
an equal partner, to the cxtent that to some few it appeared that 
corporate security was dictating APEX security policies. On the 
other hand, there was really no change in the unannounced inspection 


policy. 

3. I am persuaded that [|__| analysis is correct. A STAT 
change from the unannounced inSpeéction procedure would be beneficial 
overall and any loss would be extremely minimal. Even if corporate 


security used the few days prior to the inspection to correct 
security deficiencies, this would be all to the good as improved 
security is our real intention. At any rate, our industrial audit 
teams are now quite experienced in the audit function and I feel 
sure would be sharp enough to realize what had occurred, thus could 
use this knowledge to reinforce thorough, subtle challenge that 

we expect enhancements to take place as it becomes necessary, not 
just before arrival of the CIA audit team. 
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4, J feel that we should change the policy, with one proviso 
that we retain the option to conduct unannounced audits where we 
see a particular contractor consistently resisting our security 
standards and being dishonest or not above-board in their dealings 
with our security and contracting officers. In my estimation, there 
would be little need to exercise the option as I believe there is 
now a mutuality of respect between CIA Security and our contractors. 
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